Libellus Potionis

Write (push) access to the canonical repository (hosted on Codeberg) requires two-factor authentication as a documented project policy: docs/GOVERNANCE.md ("Repository access and account security") states that any account with write access MUST have cryptographic 2FA enabled. Currently the sole maintainer is the only account with write access and has 2FA enabled; the policy binds any future account granted write access. Codeberg additionally blocks plain-password HTTP/S git operations once 2FA is enabled, so access requires a token or SSH key. The forge offers no per-project 2FA enforcement toggle, so the requirement is enforced by written policy. Reference: https://codeberg.org/godisch/potillus/src/branch/main/docs/GOVERNANCE.md [require_2FA]

On Codeberg (Forgejo), collaborators are never added automatically: the repository owner must explicitly invite each collaborator and manually assign an access level (Read/Write/Admin); there is no automatic addition or privilege escalation. The project also currently has a single maintainer, so no additional collaborators with elevated access exist. The set of accounts with write access is documented in docs/GOVERNANCE.md. Any future collaborator therefore requires a deliberate, manual permission grant by the owner.

The primary branch (main) on the project's Codeberg repository has a branch-protection rule that permits changes only through pull requests; direct pushes are rejected server-side by the forge's pre-receive enforcement, which on Codeberg/Forgejo applies to repository admins and the owner as well. All changes to main therefore go through a pull request, satisfying the enforcement requirement even though the project currently has a single maintainer.

The primary branch (main) is the repository's default branch and is additionally covered by a branch-protection rule. On Codeberg/Forgejo the default branch cannot be deleted at all, and a protected branch is likewise non-deletable while the rule is active; any branch deletion in the web UI further requires explicit confirmation with a permanence warning. Deleting the primary branch is therefore treated as a blocked, non-accidental action, exceeding the "require explicit confirmation of intent" requirement.

The project currently operates no automated, event-triggered CI/CD pipeline: no runner processes push/pull-request events or untrusted contributor input. The only release automation (Fastlane) is invoked manually and locally by the maintainer on their own trusted working copy and does not ingest untrusted metadata. As no pipeline operates on untrusted metadata, this requirement's precondition does not occur. Should a CI pipeline (e.g. Woodpecker) be introduced, untrusted inputs (PR titles, branch names, fork payloads) will be sanitized and validated and untrusted-PR builds run without access to privileged credentials.

The project operates no automated CI/CD pipeline that builds untrusted code snapshots (e.g. pull requests from forks); no runner executes contributor-supplied code. Release automation (Fastlane) is invoked manually and locally by the maintainer against their own trusted checkout, and privileged credentials (release-signing keystore, store-upload keys) exist only in the maintainer's local, git-ignored keystore.properties, never exposed to a pipeline. As no pipeline operates on untrusted code snapshots, this requirement's precondition does not occur. A future CI pipeline (Woodpecker) will run untrusted-PR builds without access to privileged credentials — recorded in docs/ROADMAP.md.

All official project channels are served exclusively over encrypted transport. The canonical repository and issue tracker (codeberg.org/godisch/potillus) are reached over HTTPS (and Git over HTTPS/SSH), and the distribution page (f-droid.org/packages/de.godisch.potillus) is HTTPS-only; both Codeberg and F-Droid enforce HTTPS with HSTS. No project URL uses plain HTTP.

The distribution channel is protected against adversary-in-the-middle attacks by cryptographically authenticated delivery, not transport security alone. The app is published on F-Droid (f-droid.org/packages/de.godisch.potillus) over HTTPS, where F-Droid cryptographically signs its repository index and signs the APK. The build is reproducible: F-Droid rebuilds the app from the published GPL-licensed source and verifies the result bit-for-bit against the developer-signed APK before publishing, so the distributed binary is provably the one built from public source. Clients therefore verify a signed index and a signed package whose provenance is independently reproducible. Codeberg source access is likewise HTTPS-only.

The public repository leaks no valid private credentials. It contains no keystore or private-key files (no .jks/.keystore/.pem/.p12, no real keystore.properties) and no hard-coded passwords or API keys. Release signing material and the Google Play service-account key are explicitly git-ignored (/android/keystore.properties, /fastlane/play-store-credentials.json) and marked "SECRET, never commit"; only a documented placeholder template (android/keystore.properties.example) is committed, and the Play key is referenced only by path/SUPPLY_JSON_KEY, never embedded. [no_leaked_credentials]

The project provides basic user documentation. A comprehensive, screen-by-screen User's Guide (android/docs/guide/usersguide.md.in, localized into ~20 languages) explains every screen and feature — Today, Calendar, Statistics, Drinks, and Settings (limits, backup/restore, security, appearance) — and is rendered and displayed inside the app itself (via tools/render-guide.py, shown in DocumentViewerScreen). The README additionally documents the app's purpose, feature set, platform requirements (Android 11+), and how to obtain it. Source: https://codeberg.org/godisch/potillus/src/branch/main/android/docs/guide/usersguide.md.in and https://codeberg.org/godisch/potillus/src/branch/main/README.md [documentation_basics]

Users submit bug reports through the project's Codeberg issue tracker, with android@godisch.de offered as an alternative. This process is documented in the README's "Feedback & Contributing" section. URL: https://codeberg.org/godisch/potillus/issues (documented at https://codeberg.org/godisch/potillus/src/branch/main/README.md#feedback--contributing) [report_process]

Discussion of proposed changes and issues takes place in the project's Codeberg issue tracker and pull requests (https://codeberg.org/godisch/potillus/issues). This mechanism is full-text searchable; every issue, pull request, and comment is addressable by a stable URL; any person with a free Codeberg account can open issues and join the discussion; and it is used entirely through a web browser, requiring no proprietary client-side software (Codeberg runs the FLOSS Forgejo platform). [discussion]

The contribution process is documented in CONTRIBUTING.md, Section 2 "Submitting changes": contributors open an issue to discuss the change, then submit it as a pull request against main on Codeberg (a patch by e-mail is accepted as an alternative); the change must meet the documented architecture, coding, testing, and translation conventions, and is reviewed and merged by the maintainer. URL: https://codeberg.org/godisch/potillus/src/branch/main/CONTRIBUTING.md#2-submitting-changes [contribution]

The GPL-3.0-or-later license for the repository contents is approved by the Open Source Initiative (OSI).

The software is released as Free/Libre and Open Source Software under the GNU General Public License v3.0 or later (GPL-3.0-or-later). The full license text is provided in LICENSE.md, the copyright notice in COPYING.md ("either version 3 of the License, or (at your option) any later version"), and the F-Droid metadata declares License: GPL-3.0-or-later. See https://codeberg.org/godisch/potillus/src/branch/main/LICENSE.md [floss_license]

The project's license is posted in a standard location at the repository root as LICENSE.md (full GPL-3.0-or-later text), which Codeberg/Forgejo auto-detects and displays as the project license; COPYING.md sits alongside it with the copyright notice. URL: https://codeberg.org/godisch/potillus/src/branch/main/LICENSE.md [license_location]

The released software assets carry the same GPL-3.0-or-later license as the source. In the repository the license is posted in a standard location at the root — LICENSE.md (full GPL-3.0-or-later text) with COPYING.md alongside — which Codeberg/Forgejo auto-detects. The license also travels with the released application: the app bundles a copyright/license notice (res/raw/copyright.md, generated from the source license via tools/render-copyright.py) that is shown in-app, and F-Droid builds the published APK from this GPL-licensed source and distributes that source alongside the binary. URL: https://codeberg.org/godisch/potillus/src/branch/main/LICENSE.md

The project uses a publicly readable, version-controlled Git repository with a stable URL: https://codeberg.org/godisch/potillus — readable without an account and cloneable over HTTPS. [repo_public]

The project's source repository uses Git, which inherently records, for every commit, what changed (the diff/tree), who made the change (author and committer identity), and when (author and commit timestamps). The full history is publicly browsable on Codeberg (commit list, diffs, and blame view) at https://codeberg.org/godisch/potillus/commits/branch/main [repo_track]

External dependencies are declared in a computer-processable, versioned form and are obtained automatically by a standard build. The Gradle version catalog (android/gradle/libs.versions.toml) pins every library and plugin version in its [versions], [libraries], and [plugins] tables, referenced via alias(libs.…) in the build scripts; settings.gradle.kts configures the repositories (google, mavenCentral, gradlePluginPortal), so ./gradlew resolves and downloads all declared dependencies with no manual steps. The build additionally generates a CycloneDX 1.6 JSON SBOM of the release dependencies as a standardized machine-readable inventory. URL: https://codeberg.org/godisch/potillus/src/branch/main/android/gradle/libs.versions.toml [external_dependencies]

The project consists of a single source repository (codeberg.org/godisch/potillus) with no Git submodules and no separate subproject repositories. As the project does not span multiple repositories, this requirement's precondition does not apply. Should the project ever split into multiple repositories, the constituent codebases would be documented (e.g. in README.md/docs/).

The version control system contains no artifacts generated by the project's own build. All build outputs (APK/AAB, AAR, .dex, .class, compiled libraries) are produced under git-ignored directories (android/build, android/app/build, android/.gradle) and are never committed. The only committed binary is gradle/wrapper/gradle-wrapper.jar, the upstream Gradle bootstrap wrapper whose in-repository presence is the Gradle-recommended practice; it is not a project-generated artifact. Its integrity is addressed under OSPS-QA-05.02.

The only executable/library binary committed to version control is gradle/wrapper/gradle-wrapper.jar, the standard Gradle Wrapper bootstrap (committing it is Gradle's recommended practice and is required to build without a pre-installed Gradle). It is not an opaque, unreviewable blob: it is a stock Gradle Wrapper jar whose authenticity is independently verifiable via the OpenSSF/Gradle wrapper-validation tooling. The build additionally pins the Gradle distribution by cryptographic checksum in gradle/wrapper/gradle-wrapper.properties (distributionSha256Sum, with validateDistributionUrl=true), so the wrapper can only bootstrap an authenticated official Gradle release; the pinned checksum was verified against the value Gradle publishes for that release. On every Gradle update the wrapper is regenerated from the verified distribution (documented in CONTRIBUTING.md §7), so the committed jar remains a stock, verifiable wrapper regardless of version. All other binary files are content assets explicitly excluded by this control — graphical images (PNG, SVG), TTF fonts, and sample report PDFs. No executable application binaries or opaque library files are committed.

The process for reporting vulnerabilities is published in SECURITY.md at the repository root (which Codeberg/Forgejo surfaces as the project's security policy) and is linked from the README's "Security" section. Reporters are asked to disclose privately via PGP-encrypted e-mail to android@godisch.de rather than opening a public issue. URL: https://codeberg.org/godisch/potillus/src/branch/main/SECURITY.md [vulnerability_report_process]